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Accountability  *  Integrity  *  Reliability 


United  States  General  Accounting  Office 
Washington,  DC  20548 


April  30,  2001 

The  Honorable  John  Warner 
Chairman 

The  Honorable  Carl  Levin 
Ranking  Member 
Committee  on  Armed  Services 
United  States  Senate 

The  Honorable  Bob  Stump 
Chairman 

The  Honorable  Ike  Skelton 
Ranking  Minority  Member 
Committee  on  Armed  Services 
House  of  Representatives 

The  Department  of  Veterans  Affairs  (VA)  and  the  Department  of  Defense 
(DOD)  combined  provide  health  care  services  to  approximately  12  million 
veterans,  military  personnel,  and  dependents  at  an  annual  cost  of  $34 
billion.  The  Veterans  Health  Administration  (VHA)  and  the  Military  Health 
System  (MHS)  collect  and  maintain  patient  health  information  in  separate 
systems.  The  Gulf  War  exposed  many  deficiencies  in  these  systems  and 
highlighted  the  need  for  VA  and  DOD  to  be  able  to  readily  access  and 
transfer  accurate  health  data  on  their  respective  populations.  In  December 
1992,  the  Congress  asked  us  to  report  on  how  VA  and  DOD,  along  with  the 
Indian  Health  Service  (IHS),  could  share  information  technology  (IT)  and 
patient  medical  information  to  provide  greater  continuity  of  care, 
accelerate  VA  eligibility  determinations,  and  save  software  development 
costs.1  In  November  1997,  the  President  called  for  VA  and  DOD  to  create 
an  interface  that  would  allow  the  two  agencies  to  share  patient  health 
information. 

In  1998,  the  Government  Computer-Based  Patient  Record  (GCPR)  project 
was  initiated  by  VA,  DOD,  and  IHS,  which  was  included  in  the  effort 
because  of  its  population-based  research  expertise  and  its  long-standing 
relationship  with  VA.  Early  project  documents  stated  that,  when 
completed,  GCPR  would  allow  health  care  professionals  to  “share  clinical 


1See  Federal  Health  Care:  Increased  Information  System  Sharing  Could  Improve  Service, 
Reduce  Costs  (GAO/IMTEC-93-33BR,  June  1993). 
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information  via  a  comprehensive,  lifelong  medical  record.”  Given  the 
inherent  complexity  of  such  an  undertaking  and  the  value  of  achieving  this 
capability,  the  Congress  directed  us  to  report  on  the  status  of  the  GCPR 
effort.  Specifically,  we  were  asked  to  (1)  describe  GCPR’s  time  frames, 
costs,  and  expected  benefits;  (2)  determine  whether  barriers  to  the 
progress  of  the  project  exist;  and  (3)  if  barriers  exist,  describe  agency 
actions  to  address  them.2 

Our  review  of  the  GCPR  project  was  based  on  site  visits  to  VA,  DOD,  and 
IHS  facilities  and  on  interviews  with  officials  at  these  facilities  and  at  the 
agencies’  headquarters,  GCPR  management  and  contractors,  and  medical 
IT  experts  from  the  health  care  industry.  We  also  reviewed  relevant  GCPR 
project  documents  as  well  as  documents  on  the  three  agencies’  health 
information  systems.  In  addition,  we  conducted  site  visits  to  several 
private  sector  health  care  organizations  that  are  also  undertaking  efforts  to 
link  disparate  health  information  systems,  and  we  interviewed 
representatives  of  these  organizations  about  their  experiences.  We 
conducted  this  review  from  March  2000  through  February  2001  in 
accordance  with  generally  accepted  government  auditing  standards.  For 
more  on  our  scope  and  methodology,  see  appendix  I. 


Results  in  Brief 


Expanding  time  frames  and  cost  estimates,  as  well  as  inadequate 
accountability  and  poor  planning,  have  raised  doubts  about  GCPR’s  ability 
to  provide  its  expected  benefits,  prompting  the  agencies  to  refocus  their 
approach  to  the  project.  Initial  plans  called  for  the  agencies  to  begin 
worldwide  deployment  of  GCPR  on  October  1,  2000,  but  intermediate 
target  dates,  such  as  those  for  testing,  were  not  met,  pushing  project 
deployment  out  to  an  undefined  date.  GCPR  cost  estimates  have  also 
proven  to  be  unreliable.  In  September  1999,  GCPR  was  estimated  to  cost 
about  $270  million  over  its  10-year  life  cycle,  by  August  2000,  projections 
for  GCPR  stood  at  $360  million — estimates  that  GCPR  project  managers 
acknowledge  are  probably  understated.  By  the  end  of  2000,  it  became 
evident  that,  in  the  near  term,  physicians  and  other  health  care 
professionals  would  not  have  access  to  comprehensive  beneficiary  health 
information  across  the  three  partner  agencies,  limiting  the  extent  to  which 
the  effort  will  provide  the  benefits  originally  envisioned — including 
improved  research  and  quality  of  care  as  well  as  clinical  and 
administrative  efficiencies. 


2H.R.  Rep.  No.  106-616  at  383  (2000). 
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With  accountability  for  GCPR  blurred  across  several  management  entities, 
basic  principles  of  sound  IT  project  planning,  development,  and  oversight 
have  not  been  followed,  creating  barriers  to  progress.  For  example,  clear 
goals  and  objectives  have  not  been  set;  detailed  plans  for  the  design, 
implementation,  and  testing  of  the  interface  have  not  been  developed;  and 
critical  decisions  are  not  binding  on  all  partners.  In  addition,  GCPR  plans 
have  not  resolved  data  incompatibilities  and  other  differences  that 
complicate  the  electronic  exchange  of  health  information  among  the  three 
agencies’  facilities.  Finally,  concerns  related  to  developing  a 
comprehensive  strategy  to  guarantee  the  privacy  and  security  of  health 
information  shared  through  GCPR  have  not  been  addressed. 

In  September  2000,  we  discussed  these  barriers  with  VHA’s  and  MHS’ 

Chief  Information  Officers  (CIO).  Soon  after,  they  began  to  exercise  much 
needed  oversight,  temporarily  suspending  further  work  on  previously 
planned  project  activities  and  focusing  on  more  immediate  and  less 
ambitious  returns  from  GCPR.  According  to  the  CIOs,  they  are  developing 
plans  for  an  interim  effort  to  allow  VHA  to  view  DOD  health  data  and 
expect  to  have  this  capability  by  fall  2001.  They  plan  to  evaluate  their 
existing  IT  products  as  well  as  commercial  products  that  have  a  similar 
aim  of  sharing  patient  data  to  determine  whether  these  technologies  can 
be  used  for  the  interim  effort,  which  may  allow  VA  and  DOD  to  reduce  or 
eliminate  redundancies.  However,  this  interim  effort,  which  does  not 
include  IHS  as  a  partner,  has  several  major  limitations.  For  example, 
physicians  at  Military  Treatment  Facilities  (MTF)  will  not  be  able  to  Anew 
VHA  health  information — or  information  from  other  MTFs.  Moreover,  the 
information’s  usefulness  to  health  care  providers  and  researchers  will 
likely  be  limited,  in  part  because  the  requested  data  could  take  as  long  as 
48  hours  to  receive.  Once  DOD  data  are  accessible  to  VA,  project  officials 
report  that  they  plan  to  resume  the  broader,  longer-term  effort — 
establishing  a  link  among  multiple  health  information  systems  to  provide 
comprehensive  patient  information  to  physicians  and  other  health  care 
professionals  in  the  three  agencies.  However,  to  date,  formal  plans  for  the 
interim  effort  and  the  resumption  of  the  broader  GCPR  project  have  not 
been  developed.  To  help  ensure  that  GCPR  succeeds  in  exchanging  patient 
health  information,  we  are  making  recommendations  for  VA  and  DOD  to 
continue  to  improve  their  oversight  and  planning  of  the  project. 

In  commenting  on  our  draft  report,  VA,  DOD,  and  IHS  concurred  with  the 
findings  and  recommendations.  In  their  comments,  the  agencies  also 
outline  a  new  approach  for  GCPR. 
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Background 


The  GCPR  effort  developed  out  of  VA  and  DOD  discussions  about  ways  to 
share  data  in  their  health  information  systems  and  from  efforts  to  create 
electronic  records  for  active  duty  personnel  and  veterans.  The  patients 
served  by  VA’s  and  DOD’s  systems  tend  to  be  highly  mobile.  Consequently, 
their  health  records  may  be  at  multiple  federal  and  nonfederal  medical 
facilities  both  in  and  outside  the  United  States.  In  December  1996,  the 
Presidential  Advisory  Committee  on  Gulf  War  Veterans’  Illnesses  reported 
on  many  deficiencies  in  VA’s  and  DOD’s  data  capabilities  for  handling 
service  members’  health  information.  In  November  1997,  the  President 
called  for  the  two  agencies  to  start  developing  a  “comprehensive,  life-long 
medical  record  for  each  service  member.”  In  August  1998,  8  months  after 
the  GCPR  project  was  officially  established,  the  President  issued  a 
directive  requiring  VA  and  DOD  to  develop  a  “computer-based  patient 
record  system  that  will  accurately  and  efficiently  exchange  information.” 
The  directive  further  stated  that  VA  and  DOD  should  “define,  acquire,  and 
implement  a  fully  integrated  computer-based  patient  record  available 
across  the  entire  spectrum  of  health  care  delivery  over  the  lifetime  of  the 
patient”  and  recognized  VA  and  DOD’s  effort  to  “create  additional 
interface  mechanisms  that  will  act  as  bridges  between  existing  systems.”3 
IHS  became  involved  because  of  its  expertise  in  population-based  research 
and  its  long-standing  relationship  with  VA  in  caring  for  the  Indian  veteran 
population  as  well  as  IHS’  desire  to  improve  the  exchange  of  information 
among  its  facilities. 

Each  of  the  three  agencies’  health  facilities  is  linked  to  their  agency’s 
regional  database  or  an  IT  center:  VA  has  about  750  facilities  in  22  regions, 
DOD  has  about  600  MTFs  in  14  domestic  and  overseas  medical  regions, 
and  IHS  has  550  facilities  in  12  regions.4  Currently,  these  facilities  cannot 
electronically  share  patient  health  information  across  agency  lines,  and 
only  VA  facilities  have  the  capability  of  sharing  certain  information  across 
regions. 

GCPR  is  not  intended  to  be  a  separate  computerized  health  information 
system,  nor  is  it  meant  to  replace  VA’s,  DOD’s,  and  IHS’  existing  systems. 


3 

National  Science  and  Technology  Council,  A  National  Obligation:  Planning  for  Health 
Preparedness  for  and  Readjustment  of  the  Military,  Veterans,  and  Their  Families  After 
Future  Deployments,  Presidential  Review  Directive  5  (Washington,  D.C.:  Executive  Office 
of  the  President,  Office  of  Science  and  Technology  Policy,  Aug.  1998). 

VA’s  regions  are  officially  referred  to  as  Veterans’  Integrated  Service  Networks,  or  VISNs; 
IHS’  regions  are  generally  referred  to  as  areas. 
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GCPR  is  intended  to  allow  physicians  and  other  authorized  users  at  the 
agencies’  health  facilities  to  access  data  from  any  of  the  agencies’  other 
health  facilities  by  serving  as  an  interface  among  their  health  information 
systems  (see  fig.  1).  As  envisioned,  the  interface  would  compile  requested 
patient  information  in  a  temporary  or  virtual  record  while  appearing  on 
the  computer  screen  in  the  format  of  the  user’s  system.  GCPR  would 
divide  health  data  into  24  categories,  or  “partitions,”  including  pharmacy, 
laboratory  results,  adverse  reactions,  vital  signs,  patient  demographics, 
and  doctors’  notes. 
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Figure  1 :  GCPR  Interface  With  Agencies’  Health  Information  Systems 


DOD  Facilities'  IHS  Facilities' 

Composite  Health  Resource  and  Patient 

Care  System  Management  System 

(CHCS)  I  &  II  (RPMS) 


GCPR 


VA  Facilities' 
Veterans  Health 
Information  Systems  and 
Technology  Architecture 
(VISTA) 


Source:  GAO. 


With  this  ability  to  exchange  information,  GCPR  is  expected  to  achieve 
several  benefits,  including  improving  quality  of  care;  providing  data  for 
population-based  research  and  public  health  surveillance;  advancing 
industrywide  medical  information  standards;  and  generating 
administrative  and  clinical  efficiencies,  such  as  cost  savings. 
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Several  management  entities  share  responsibility  for  GCPR: 

•  Military  and  Veterans  Health  Coordinating  Board:  This  entity  was  created 
to  ensure  coordination  among  VA,  DOD,  and  the  Department  of  Health  and 
Human  Services  (HHS)  on  military  and  veteran  health  matters,  particularly 
as  they  relate  to  deployed  settings,  such  as  the  Persian  Gulf.  The  board 
also  oversees  implementation  of  the  President’s  August  1998  directive.  The 
board  consists  of  the  Secretaries  of  VA,  DOD,  and  HHS. 

•  DOD  and  VA  Executive  Council:  The  council  was  created  to  identify  and 
implement  interagency  initiatives  that  are  national  in  scope.  One  initiative 
is  to  ensure  a  smooth  transfer  of  information  between  DOD’s  and  VA’s 
health  care  systems  through  efforts  such  as  GCPR.  The  council  comprises 
VA’s  Under  Secretary  for  Health,  DOD’s  Assistant  Secretary  for  Health 
Affairs,  their  key  deputies,  and  the  Surgeon  General  of  each  military 
branch. 

•  GCPR  Board  of  Directors-.  The  board  was  established  to  set  GCPR 
programmatic  and  strategic  priorities  and  secure  funding  from  VA,  DOD, 
and  IHS.  The  board  consists  of  the  VA  Under  Secretary  for  Health  and 
CIOs  for  MHS  and  IHS.5 

•  GCPR  Executive  Committee:  The  Executive  Committee  sets  tactical 
priorities,  oversees  project  management  activities,  and  ensures  that 
adequate  resources  are  available.  The  committee  membership  consists  of 
senior  managers  from  VA,  DOD,  and  IHS. 

GCPR  is  managed  on  a  day-to-day  basis  by  a  program  office  staffed  by 
personnel  from  VA,  DOD,  IHS,  and  the  project’s  prime  contractor, 
Litton/PRC  of  McLean,  Virginia.  Litton/PRC  is  responsible  for  building, 
shipping,  installing,  configuring,  and  operating  the  interface  and 
administering  site  training.  Battelle  Memorial  Institute  of  Columbus,  Ohio, 
holds  contracts  for  developing  medical  “reference  models,”  which  allow 
for  the  exchange  of  data  among  different  systems  without  requiring 


The  MHS  CIO  replaced  the  Deputy  Surgeon  General  of  the  Navy  as  DOD’s  representative 
on  the  board.  Previously,  the  MHS  CIO  was  an  ex-officio  member  and  was  recorded  as  a 
participant  in  board  minutes. 
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standardization.6  Assisting  in  the  project  are  government-led  work  groups, 
which  consist  of  VA,  DOD,  and  IHS  employees  and  Litton/PRC  staff.  The 
work  groups’  key  tasks  include  acquisition,  finance,  legal  work,  marketing, 
telecommunications,  and  documenting  clinical  practices. 


Time  Frames  and  Cost 
Estimates  Have 
Expanded,  and 
Expected  Benefits 
Have  Been  Delayed 


Throughout  the  course  of  the  GCPR  project,  time  frames  and  cost 
estimates  have  expanded,  and  GCPR’s  ability  to  deliver  its  expected 
benefits  has  become  less  certain.  In  1999,  initial  plans  called  for  GCPR  to 
begin  worldwide  deployment  October  1,  2000,  but  target  dates  for 
intermediate  phases,  such  as  testing,  were  not  met,  pushing  project 
deployment  out  to  an  undefined  date.  For  example,  completion  of  testing 
was  originally  scheduled  for  September  2000  but  was  delayed  until  August 
2002  (see  fig.  2). 


Comprehensive  industry  standards  for  medical  language  and  its  context  do  not  exist. 
Consequently,  different  health  information  systems  or  providers  may  use  different  terms  to 
mean  the  same  thing.  For  example,  to  indicate  a  patient  is  suffering  from  a  rhinovirus, 
some  may  use  “cold”  while  others  may  use  “upper  respiratory  disorder”  or  “nasal 
congestion.”  In  addition,  without  knowing  the  context  in  which  a  term  such  as  “cold”  is 
used,  it  is  difficult  to  determine  whether  the  patient  has  a  rhinovirus  or  feels  cold  or  has 
chronic  obstructed  lung  disease.  According  to  GCPR  project  documents,  reference  models 
would  allow  translation  among  the  different  medical  languages  and  terminologies  used  by 
VA,  DOD,  and  IHS. 
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Figure  2:  GCPR  Time  Frames  as  of  January  1999  and  September  2000 
January  1999  (Original) 


Complete 

Prototype  End  Testing  (Sept.  30,  2000) 

Demonstration  Begin  Worldwide  Deployment  (Oct.  1 , 2000) 

Phase  I  Phase  II  &  Phase  III 


i  I 

1  2  3  4  5  6  7  8  9  10  11  12 


2000 


1  2  3  4  5  6  7  8  9  10  11  12 

- 2001  - 


1  2  3  4  5  6  7  8  9  10  11  12 

- 2002  - 


1  2  3  4  5  6  7  8  9  10  11  12 

- 2003 


1  2  3  4  5  6  7  8  9  10  11  12 

1 

Phase  I 

Complete  Prototype 
Demonstration 
Mar.  2000 


1  2  3  4  5  6  7  8  9  10  11  12 

I 

Phase  II 

End  Lab 
Testing 
June  2001 


1  2  3  4  5  6  7  8  9  10  11  12 

i  i 

End  Alpha  End  Beta 
Field  Testing  Field  Testing 
Feb.  2002  Aug.  2002 


1  2  3  4  5  6  7  8  9  10  11  12 


Phase  III 

World  wide 
Deployment  (Not 
Determined) 


September  2000  (Revised) 

Source:  GCPR  project  documents. 


GCPR  cost  estimates  also  increased.  GCPR  was  estimated  in  September 
1999  to  cost  about  $270  million  over  its  10-year  life  cycle;  by  August  2000, 
projections  for  GCPR  stood  at  $360  million  (see  table  1).  However,  GCPR 
project  officials  told  us  that  the  cost  estimates  were  unreliable  and 
probably  understated,  in  part  because  some  costs — such  as  computer 
hardware  needed  by  the  project’s  contractors — were  not  included.  Other 
cost  estimates,  such  as  those  for  deployment,  could  not  be  verified.  In  the 
case  of  deployment,  final  decisions  affecting  costs  were  not  made. 
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Table  1:  Changes  in  GCPR’s  Estimated  Project  Cost 

(Dollars  in  millions) 

Phase 

Estimates  as  of 
Sept.  1999 

Estimates  as  of 
Aug. 2000 

Preliminary 

$12.5 

$1.8 

Phase  1  (prototype  and  proof  of  concept) 

42.0 

17.7 

Phase  II  (pilot,  alpha-,  and  beta-field  testing) 

23.3 

98.2 

Phase  III  (phased  deployment) 

92.8 

133.5 

Ongoing  operations 

99.0 

108.7 

Total 

$269.6 

$359.9 

Source:  GCPR  project  documents. 

By  the  end  of  2000,  it  became  apparent  that  the  benefits  described  in 
GCPR  project  documents  and  brochures  and  on  its  website — including 
access  to  comprehensive,  life-long  patient  information — would  not  be 
realized  in  the  near  future.  According  to  Litton/PRC,  preliminary  testing  of 
data  transfer  among  selected  VA  facilities  is  demonstrating  that  the  GCPR 
technology  works.  However,  significant  issues  in  sharing  comprehensive 
patient  data  have  not  been  adequately  addressed.  For  example,  while 
GCPR  managers  planned  to  field  test  67  of  the  24  data  partitions,  they  had 
no  plans  for  when  other  partitions  would  be  tested.  Moreover,  access  was 
to  be  limited  to  patient  information  in  VA’s,  DOD’s,  and  IHS’  health 
information  systems;  information  in  other  major  data  sources,  such  as 
TRICARE — DOD’s  managed  care  program — and  other  third-party 
providers  would  not  be  accessible.  Access  to  patient  information  would  be 
further  limited  because  full  deployment  of  CHCS  II — DOD’s  new,  more 
comprehensive  health  information  system,  currently  under  development — 
has  been  delayed  until  2004  as  the  result  of  complications  such  as  limited 
system  capacity  and  slow  response  time.  With  CHCS  II,  GCPR  would 
provide  access  to  information  on  immunizations;  allergies;  and  outpatient 
encounters,  such  as  diagnostic  and  treatment  codes;  as  well  as  to 
information  in  CHCS  I,  DOD’s  current  system,  which  primarily  includes 
information  on  patient  hospital  admission  and  discharge,  patient 
medications,  laboratory  results,  and  radiology.  Providing  other  anticipated 
benefits — such  as  improved  quality  of  patient  health  records — will  also  be 
difficult  because  GCPR  plans  do  not  include  steps  for  correcting  long¬ 
standing  data  problems,  such  as  inaccurate  data  entries. 


7 

Demographics,  security,  laboratory  results,  problem  lists,  medication  profiles,  and  adverse 
reactions. 
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Inadequate 
Accountability  and 
Planning 

Compromised  GCPR’s 
Progress 


The  lack  of  accountability  and  sound  IT  project  planning — critical  to  any 
project,  particularly  an  interagency  effort  of  this  magnitude  and 
complexity — put  GCPR  at  risk  of  failing.  The  relationships  among  GCPR’s 
management  entities  were  not  clearly  established,  and  no  one  entity  had 
the  authority  to  make  final  project  decisions  binding  on  the  other  entities. 
As  a  result,  plans  for  the  development  of  GCPR  have  not  included  a  clear 
vision  for  the  project  and  have  not  given  sufficient  attention  to 
technological  and  privacy  and  security  issues  as  the  effort  has  moved 
forward.8 


Lack  of  Accountability  From  the  outset,  decision-making  and  oversight  were  blurred  across 

Undermined  Agencies’  several  management  entities,  compromising  GCPR’s  progress.  The  roles 

Commitment  to  the  Project  anc^  resPonsibilities  of  these  entities  and  the  relationships  among  them  are 

not  spelled  out  in  the  VA-DOD-IHS  memorandum  of  agreement  (MOA), 
and  no  one  entity  exercised  final  authority  over  the  project.  The  Board  of 
Directors  and  the  Executive  Committee  did  not  follow  sound  IT  business 
practices — such  as  ensuring  agency  commitment,  securing  stable  funding, 
and  monitoring  the  project’s  progress — as  dictated  by  federal 
requirements.9  For  example,  GCPR  documents  show  that  VA,  DOD,  and 
IHS  should  provide  consistent  project  funding  of  40  percent,  40  percent, 
and  20  percent,  respectively,  but  DOD  has  never  provided  this  level  of 
funding  and,  at  times,  temporarily  withheld  funding  it  had  promised. 
Moreover,  the  Board  of  Directors  and  the  Executive  Committee  did  not 
exercise  sufficient  oversight,  including  monitoring,  to  ensure  that  the 
project  would  be  adequately  funded. 

Without  agency  commitment  and  sufficient  oversight,  the  project  team  has 
been  limited  in  its  ability  to  manage  GCPR  effectively  or  efficiently. 
Unstable  funding  forced  GCPR  project  managers  to  develop  and  issue 
multiple  short-term  contracts  for  work  that  could  have  been  covered  by  a 
single  longer-term  contract.  At  one  point  during  our  review,  project 
managers  told  us  that  the  project  would  end  after  field-testing  because  of  a 
lack  of  adequate  funding  and  a  lack  of  a  clear  mandate  to  proceed  with  full 


sAn  earlier  independent  risk  assessment  by  Northpoint  Software  Ventures,  Inc.,  found 
similar  weaknesses  in  GCPR’s  business  practices. 

9Six  laws  largely  lay  out  the  IT  management  responsibilities  of  federal  agencies:  the  Federal 
Records  Act  of  1950,  the  Privacy  Act  of  1974,  the  Computer  Security  Act  of  1987,  the 
Paperwork  Reduction  Act  of  1995,  the  Clinger-Cohen  Act  of  1996,  and  the  Government 
Paperwork  Elimination  Act  of  1998. 
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deployment,  even  though  plans  called  for  the  project  to  continue  through 
deployment. 


Inadequate  Planning  The  three  partner  agencies  never  reached  consensus  on  GCPR’s  mission 

Hindered  Progress  and  how  it  would  relate  to  the  individual  agencies’  missions.  In  addition, 

key  project  documents,  such  as  the  MOA  establishing  GCPR,  have  not 
adequately  spelled  out  the  project’s  goals  and  objectives.  For  example, 
some  DOD  officials  thought  GCPR’s  mission  paralleled  the  goals  and 
objectives  of  Presidential  Review  Directive  5;  however,  GCPR  project 
managers  did  not  share  this  understanding  and  the  directive  was  never 
adopted  as  GCPR’s  mission.  Without  an  agreed  upon  mission  with  clear 
goals  and  objectives,  it  remained  unclear  what  problem  GCPR  was  trying 
to  solve.  This  lack  of  consensus  on  the  project’s  mission,  goals,  and 
objectives  affected  the  agencies’  dedication  of  resources.  Expecting  GCPR 
to  enhance  its  ability  to  carry  out  its  mission  to  provide  health  care  to 
veterans,  VA  was  providing  the  most  funding  to  the  project.  In  contrast, 
DOD  elected  to  place  priority  on  funding  CHCS  II,  which  is  estimated  to 
cost  several  billion  dollars  because  officials  believe  it  will  more 
specifically  address  the  Department’s  health  mission. 

GCPR  plans  have  also  not  sufficiently  addressed  other  critical  issues  that 
need  to  be  resolved,  such  as  decisions  about  key  data  elements.  For 
example,  DOD  and  IHS  use  different  identifiers  to  match  health  records  to 
patients — DOD  facilities  use  Social  Security  numbers,  while  IHS  facilities 
use  facility-specific  health  record  numbers.  Differences  such  as  these 
complicate  the  electronic  exchange  of  health  information.  Further,  in  the 
absence  of  common  medical  terminology,  project  personnel,  assisted  by 
Battelle,  are  developing  reference  models  they  believe  will  interpret  VA, 
DOD,  and  IHS  data  and  present  the  data  in  a  format  understandable  to  the 
user — without  requiring  cross-agency  standards.  However,  GCPR  plans 
have  not  specified  the  key  tasks  for  developing  these  models,  their  relation 
to  one  another,  and  who  should  carry  them  out.  As  a  result,  work 
progressed  slowly  and  rework  has  been  necessary.  For  example, 
coordination  between  the  Battelle  team  and  Litton/PRC  was,  initially,  not 
adequate  to  ensure  that  the  reference  models  developed  by  Battelle  would 
meet  Litton/PRC’s  technical  requirements  for  developing  the  interface. 
Therefore,  the  models  had  to  be  revised. 

In  addition,  the  MOA  and  other  key  project  documents  did  not  lay  out  the 
specific  roles  and  responsibilities  of  VA,  DOD,  and  IHS  in  developing, 
testing,  and  deploying  the  interface.  GCPR  plans  also  did  not  describe  how 
the  project  would  use  the  agencies’  existing  technologies  for  sharing 
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patient  health  information  and  to  avoid  duplication  of  effort.  For  example, 
GCPR  plans  do  not  discuss  VA’s  “remote  view”  capability — which  will 
allow  users  of  VA’s  Computer  Patient  Record  System  (CPRS)10  to 
simultaneously  view  health  data  across  multiple  facilities — or  three  of 
DOD’s  health  information  systems:  Theater  Medical  Information  Program 
(TMIP),  Pacific  Medical  Network  (PACMEDNET),  and  Pharmacy  Data 
Transaction  System  (PDTS).11 

Finally,  a  comprehensive  strategy  to  guarantee  the  privacy  and  security  of 
electronic  information  shared  through  GCPR  was  not  developed.  GCPR’s 
draft  privacy  and  security  plan  delegates  primary  responsibility  for 
ensuring  privacy  and  security  to  more  than  1,000  VA,  DOD,  and  IHS  local 
facilities,  with  few  additional  resources  and  little  guidance.  However, 
there  have  been  long-standing  privacy  and  security  problems  within  VA’s, 
and  DOD’s  information  systems.  For  example,  weak  access  controls  put 
sensitive  information — including  health  information — at  risk  of  deliberate 
or  inadvertent  misuse,  improper  disclosure,  or  destruction.12  By  providing 
broader  access  to  more  users,  GCPR  may  exacerbate  these  risks.  DOD  is 
required  by  the  Floyd  D.  Spence  National  Defense  Authorization  Act  for 
2001  (P.L.  106-398)  to  submit  to  the  Congress  a  comprehensive  plan 
consistent  with  HHS  medical  privacy  regulations  to  improve  privacy. 13  The 
act  also  requires  DOD  to  promulgate  interim  regulations  that  allow  for  use 
of  medical  records  as  necessary  for  certain  purposes,  including  patient 
treatment  and  public  health  reporting,  thus  providing  DOD  the  flexibility 
to  share  patient  health  information  through  a  mechanism  such  as  GCPR. 
The  HHS  privacy  regulations  went  into  effect  on  April  14,  2001,  and 
contain  provisions  that  require  consent  to  disclose  health  information 


10CPRS  is  a  component  system  of  VISTA. 

nDOD’s  TMIP,  currently  under  development,  is  intended  to  capture  medical  information  for 
deployed  personnel;  PACMEDNET  is  a  joint  DOD/VA  effort  to  link  medical  records  in  the 
Pacific  region;  and  PDTS  is  DOD’s  new  patient  drug  transaction  and  safety  database. 
Program  costs  are  $14.8  million  for  PDTS  and  $19.5  million  for  PACMEDNET;  program 
costs  for  TMIP  have  not  been  determined. 

12 

See  Information  Security:  Serious  and  Widespread  Weaknesses  Persist  at  Federal 
Agencies  (GAO/AIMD-OO-295,  Sept.  6,  2000). 

13The  Health  Insurance  and  Portability  Act  (HIPAA)  requires  the  development  of 
comprehensive  privacy  standards  that  would  establish  rights  for  patients  with  respect  to 
their  medical  records  and  define  the  conditions  for  using  and  disclosing  identifiable  health 
information.  (P.L.  104-191,  264,  110  Stat.  1936,  2033.)  The  final  regulations  require  that 
patient  consent  must  be  secured  before  disclosing  information  in  individual  medical 
records. 
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before  engaging  in  treatment,  payment,  or  health  care  operations  (45 
C.F.R.  parts  160-164).14 


CIOs  Change 
Immediate  Focus, 
Serious  Concerns 
Remain 


Over  the  past  several  months,  we  have  provided  briefings  on  our  findings 
to  agency  and  project  officials,  including  the  CIOs  of  VHA  and  MHS  whom 
but  we  initially  briefed  in  September  2000.  Concerned  about  the  lack  of 

progress  and  the  significant  weaknesses  that  we  found,  the  CIOs  have 
begun  to  exert  much  needed  oversight.  They  told  us  that  they  are  now 
focusing  on  “early  deliverables”  for  VA  and  DOD.  To  ensure  more 
immediate  applicability  of  GCPR  to  their  missions,  VA  and  DOD’s  current 
priority  is  to  allow  VA  health  care  providers  to  view  DOD  health  data  by 
the  end  of  September  2001.  Once  this  interim  effort  is  completed,  the  CIOs 
told  us  that  they  plan  to  resume  the  broader  GCPR  project — establishing  a 
link  among  all  three  partner  agencies’  health  information  systems. 


Under  the  interim  effort,  as  described  by  the  CIOs,  certain  trigger  events, 
such  as  a  new  veteran  enrolling  for  VA  medical  treatment,  will  prompt 
VISTA  to  contact  a  central  server,  which  would  search  the  hundreds  of 
CHCS  I  sites  and  collect  any  data  on  that  patient.  To  help  ensure  efficient 
development  of  the  interim  effort,  VA  and  DOD  now  plan  to  evaluate  their 
existing  IT  products — such  as  VA’s  remote  view  capability,  which  could 
have  the  potential  to  facilitate  the  retrieval  of  DOD  health  data — as  well  as 
commercial  products  to  determine  if  these  technologies  can  be  used  to 
electronically  transmit  data  among  the  agencies’  systems.  While  we  did  not 
conduct  an  in-depth  review  of  these  initiatives,  we  agree  that  such  an 
evaluation  may  allow  VA  and  DOD  to  reduce  or  eliminate  redundancies 
because  these  products  have  a  common  aim  of  sharing  patient  data. 
However,  it  is  unclear  to  what  extent  the  interim  effort  will  be  using  the 
GCPR  technology — which,  according  to  Litton/PRC,  has  demonstrated 
that  data  can  be  moved  among  VA  facilities. 

However,  our  concerns  regarding  the  usefulness  of  the  information — and 
the  implications  for  GCPR’s  expected  benefits — still  remain.  For  example, 
under  the  interim  effort,  the  requested  information  is  expected  to  take  as 
long  as  48  hours  to  be  received.  In  addition,  only  authorized  VHA 
personnel  will  have  the  ability  to  see  CHCS  I  data  from  MTFs;  health  care 


14The  Secretary  of  HHS  has  stated  that  there  will  be  guidelines  and  modifications  made  to 
the  consent  provisions  to  make  it  clear  that  doctors  and  hospitals  will  have  access  to 
necessary  medical  information  about  patients  whom  they  are  treating. 
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providers  at  MTFs  will  not  be  able  to  view  health  information  from  VHA — 
or  information  from  other  MTFs.  It  is  also  unclear  whether  all  or  only 
selected  VA  and  DOD  facilities  will  have  the  interim  capability  now  being 
proposed.  IHS  will  not  be  included  in  the  interim  effort.  Moreover,  the 
interim  effort  will  rely  on  DOD’s  aging  system,  CHCS  I,  which  historically 
has  not  been  adequate  to  meet  physicians’  needs.  CHCS  I  is  primarily 
limited  to  administrative  information  and  some  patient  medical 
information,  such  as  pharmacy  and  laboratory  results.  CHCS  I  does  not 
include  patient  information  on  the  health  status  of  personnel  when  they 
enter  military  service,  on  reservists  who  receive  medical  care  while  not  on 
active  duty  status,  or  on  military  personnel  who  receive  care  from 
TRICARE  providers.  CHCS  I  also  does  not  include  physician  notes  made 
during  examinations.  In  addition,  information  captured  by  CHCS  I  can 
vary  from  MTF  to  MTF.  Some  facilities,  such  as  Tripler  Army  Medical 
Center  in  Hawaii,  have  significantly  enhanced  their  CHCS  software  to 
respond  to  the  needs  of  physicians  and  other  system  users  and  to  collect 
patient  health  information  not  collected  by  other  facilities. 

Further,  the  interim  effort  will  need  to  address  many  of  the  same  problems 
that  confronted  the  broader  GCPR  effort: 

•  Transmitted  information  will  be  viewable  only  as  sent;  therefore,  it  will  not 
be  computable — that  is,  it  will  not  be  possible  to  organize  or  manipulate 
data  for  quick  review  or  research. 

•  Electronic  connectivity  among  MTFs  is  limited,  and  the  interim  effort  does 
not  propose  to  establish  facility-to-facility  links.  Currently,  only  MTFs 
within  the  same  region  and  using  the  same  DOD  IT  hardware  can  access 
one  another’s  data  using  CHCS  I. 

•  The  requested  data  will  not  be  meaningful  to  the  VA  user  unless  CHCS’ 
language  is  translated  into  VISTA’s.  For  example,  without  interpretation,  a 
VA  physician’s  VISTA  query  for  a  patient’s  sodium  level  would  not 
recognize  “NA”  (used  by  DOD)  as  equivalent  to  “sodium”  (used  by  VA). 
Until  terms  and  their  context  are  standardized  or  the  variations  are 
identified,  or  “mapped,”  across  all  VA  and  DOD  facilities,  much  of  the 
information  could  be  meaningless  to  VA  physicians. 

According  to  VHA’s  and  MHS’  CIOs,  detailed  plans  and  time  frames  are 
being  prepared  for  the  short-term,  interim  effort  to  allow  VA  to  receive 
available  electronic  health  information  in  CHCS  I.  However,  as  of  the  end 
of  February  2001,  no  agreement  on  the  goals,  time  frames,  costs,  and 
oversight  for  the  interim  approach  has  been  reached,  and  no  formal  plans 
for  the  interim  project  exist.  Moreover,  revised  plans  for  the  broader,  long- 


Page  15 


GAO-Ol-459  Government  Computer-Based  Patient  Records 


term  GCPR  project — including  how  and  when  IHS  will  resume  its  role  in 
the  project — have  not  been  developed. 

While'  a  draft  of  this  report  was  being  reviewed  by  the  agencies,  they 
developed  a  new  near-term  effort  which  they  outlined  in  their  comments. 
This  effort,  which  revises  their  interim  effort,  is  intended  to  address  our 
concerns.  However,  many  of  our  concerns  remain  and  are  addressed  in 
our  response  to  comments  from  the  agencies. 


Conclusions 


GCPR’s  aim  to  allow  health  care  providers  to  electronically  share 
comprehensive  patient  information  should  provide  VA,  DOD,  and  IHS  a 
valuable  opportunity  to  improve  the  quality  of  care  for  their  beneficiaries. 
But  without  a  lead  entity,  a  clear  mission,  and  detailed  planning  to  achieve 
that  mission,  it  is  difficult  to  monitor  progress,  identify  project  risks,  and 
develop  appropriate  contingency  plans  to  keep  the  project  moving  forward 
and  on  track.  Critical  project  decisions  were  not  made,  and  the  agencies 
were  not  bound  by  those  that  were  made.  The  VA  and  DOD  CIOs’  action  to 
focus  on  short-term  deliverables  and  to  capitalize  on  existing  technologies 
is  warranted  and  a  step  in  the  right  direction.  However,  until  problems 
with  the  two  agencies’  existing  systems  and  issues  regarding  planning, 
management,  and  accountability  are  resolved,  projected  costs  are  likely  to 
continue  to  increase,  and  implementation  of  the  larger  GCPR  effort — 
along  with  its  expected  benefits — will  continue  to  be  delayed. 


Recommendations  for 
Executive  Action 


To  help  strengthen  management  and  oversight  of  GCPR,  we  recommend 
that  the  Secretaries  of  VA  and  DOD  and  the  Director  of  IHS  reassess 
decisions  about  the  broader,  long-term  GCPR  project,  based  on  the  results 
of  the  interim  effort.  If  the  Secretaries  of  VA  and  DOD  and  the  Director  of 
IHS  decide  to  continue  with  the  broader  effort,  they  should  direct  their 
health  CIOs  to  apply  the  principles  of  sound  project  management 
delineated  in  our  following  recommendations  for  the  interim  effort. 


For  the  interim  effort,  we  recommend  that  the  Secretaries  of  VA  and  DOD 
and  the  Director  of  IHS  direct  their  health  CIOs  to  take  the  following 
actions: 


•  Designate  a  lead  entity  with  final  decision-making  authority  and  establish 
a  clear  line  of  authority. 

•  Create  comprehensive  and  coordinated  plans  to  ensure  that  the  agencies’ 
can  share  comprehensive,  meaningful,  accurate,  and  secure  patient  health 
data.  These  plans  include  an  agreed-upon  mission  and  clear  goals, 
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Agency  Comments 


objectives,  and  performance  measures,  and  they  should  capitalize  on 
existing  medical  IT  capabilities. 


VA,  DOD,  and  IHS  reviewed  and  separately  commented  on  a  draft  of  this 
report.  Each  concurred  with  the  findings  and  recommendations.  The 
agencies  also  provided  comments  that  outline  a  new  near-term  effort  for 
GCPR  and  that  aim  to  clarify  GCPR’s  purpose.  Additionally,  VA,  DOD,  and 
IHS  provided  written  technical  comments,  which  we  have  incorporated 
where  appropriate.  The  full  texts  of  their  comments  are  reprinted  as 
appendixes  II,  III,  and  IV. 

Regarding  our  recommendation  to  establish  a  clear  line  of  authority,  the 
Secretary  of  VA  committed  to  meeting  with  the  Secretary  of  Defense  and 
the  Director  of  IHS  to  designate  a  lead  entity  that  will  have  decision¬ 
making  authority  for  the  three  organizations.  He  said  that  once 
established,  that  entity  will  have  a  clear  line  of  authority  over  all  GCPR 
development  activities.  With  regard  to  our  recommendation  to  create 
comprehensive  and  coordinated  plans  for  sharing  patient  health  data,  the 
Secretary  of  VA  said  he  would  direct  the  VHA  CIO,  in  collaboration  with 
VA’s  departmentwide  CIO  to  prepare  such  plans  under  the  oversight  of  the 
lead  entity.  In  response  to  our  recommendation  that  longer-term  GCPR 
decisions  be  reassessed  based  on  the  results  of  the  interim  effort,  the 
Secretary  of  VA  responded  that  GCPR  will  be  reassessed  based  on  the 
results  of  their  near-term  effort.  Additionally,  he  said  that  the  longer-term 
strategy  will  depend  to  some  extent  on  advances  in  medical  informatics, 
standards  development,  and  the  ability  to  bring  in  additional  partners. 

DOD  provided  similar  comments  on  our  recommendation  concerning 
longer-term  GCPR  decisions  and  also  mentioned  that  it  plans  to  include 
the  Military  Health  System  Information  Management  Committee  in  GCPR 
oversight.  While  IHS  provided  no  information  on  the  steps  it  plans  to  take 
to  implement  our  recommendations,  it  commented,  along  with  VA  and 
DOD,  that  collaboration  is  essential  to  the  future  of  GCPR.  Overall,  the 
agencies’  statements,  in  our  view,  represent  a  commitment  to  oversight 
and  management  of  GCPR.  However,  it  is  much  too  soon  to  know  whether 
their  commitment  will  result  in  a  successful  project. 

VA,  DOD,  and  IHS  also  provided  information  that,  according  to  the 
organizations,  is  intended  to  serve  as  a  foundation  for  assessing  GCPR  and 
its  progress.  The  agencies  emphasized  that  GCPR  is  not  intended  to  carry 
the  whole  weight  for  the  service  members’  health  records  and  the  related 
health  information  systems,  but  instead  consists  of  the  agencies’  core 
health  information  systems  with  GCPR  handling  the  transfer  and 
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mediation  of  data.  Our  report  does  not  suggest  that  GCPR  is  a  replacement 
for  the  agencies’  information  systems  or  that  it  should  carry  the  weight  of 
the  agencies’  patient  health  information.  Rather,  our  report  states  that 
GCPR  is  intended  to  create  an  electronic  link  that  will  enable  the  agencies 
to  share  patient  data  from  their  separate  health  information  systems. 

The  agencies  also  provided  a  clarification  of  GCPR’s  purpose,  stating  that 
it  will  provide  a  longitudinal  record  covering  service  members  from  the 
start  of  their  service  through  their  care  with  VA.  VA  acknowledges  that  the 
realities  of  the  challenges  the  project  has  presented  have  led  to  a  scaling 
back  of  the  initial  version  of  GCPR  as  described  in  early  project 
documents,  such  as  budget  submissions,  contractors’  statements  of  work, 
and  project  plans.  These  documents  indicated  that  in  addition  to  including 
IHS,  GCPR  would  permit  health  care  professionals  to  share  clinical 
information  via  a  comprehensive  lifelong,  medical  record — one  that  would 
include  information  from  all  sources  of  care.  GCPR  was  similarly 
described  on  GCPR’s  home  page  and  during  briefings  to  the  Congress  and 
others,  such  as  the  National  Committee  on  Vital  and  Health  Statistics. 

Some  documents,  such  as  VA’s  Fiscal  Year  2001  Performance  Plan,  have 
described  GCPR  as  including  dependents  of  service  members.  To  the 
extent  that  the  agencies  agree  on  the  scaled-back  description  of  GCPR, 
project  documents  and  communications  need  to  reflect  this  new 
understanding.  This  is,  in  part,  why  we  recommended  that  the  agencies 
develop  and  document  a  clear,  agreed  upon  project  mission,  along  with 
specific  goals,  objectives,  and  performance  measures. 

The  agencies’  also  provided  information  on  a  new  near-term  effort  for 
GCPR,  which  they  developed  while  reviewing  our  draft  report.  According 
to  the  agencies,  this  revised  near-term  effort  that  they  have  developed  uses 
the  GCPR  framework  and  will  provide  VA  clinicians  with  DOD  data  on  all 
active  duty  members,  retirees,  and  separated  personnel.  VA  and  DOD 
recognize  that  this  one-way  flow  of  information  is  not  perfect  but  should 
be  a  substantial  improvement  for  physicians  making  medical  decisions  and 
enhance  the  continuity  of  care  for  veterans.  According  to  the  agencies,  the 
near-term  effort  is  funded  through  year  2001  and  they  expect  to  have 
initial  operating  capability  by  fall  2001.  We  agree  that,  if  successful,  this 
effort  should  provide  useful  information  to  VA  clinicians.  In  our  view,  their 
outline  of  the  new  near-term  approach  indicates  that  it  is  only  in  the 
concept  stage  and  detailed  planning  and  actual  work  are  just  beginning. 
For  example,  the  agencies  note  that  current  data  will  be  sent  in  “near  real¬ 
time  transmission,”  and  historical  data  will  be  “extracted  and  transmitted 
on  a  predetermined  schedule.”  But  they  do  not  define  “near  real-time”  and 
“predetermined  schedule.” 
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Additionally,  the  agencies  assert  that  the  new  near-term  effort  addresses 
many  of  the  concerns  we  raised  in  the  report.  However,  several  of  these 
issues  remain  and,  as  we  recommended,  need  to  be  reassessed  at  the 
conclusion  of  the  near-term  effort  because  of  their  implications  for  the 
long-term  effort: 

•  GCPR — both  the  near-term  and  larger  efforts — will  not  provide  a 
longitudinal  record  because  plans  call  for  GCPR  to  use  DOD’s  CHCS  I  for 
the  foreseeable  future.  CHCS  I,  as  DOD  acknowledges  in  its  comments, 
was  not  designed  to  include  patient  information  on  the  health  status  of 
personnel  when  they  enter  military  service,  on  reservists  who  receive 
medical  care  while  not  on  active  duty  status,  or  on  military  personnel  who 
receive  care  outside  MTFs. 

•  The  meaningfulness  of  the  transmitted  data  remains  in  question  because 
the  agencies  do  not  plan  to  standardize  or  map  the  differing  terminology  in 
their  health  information  systems.  As  we  note  in  the  report,  without 
standardized  terminology  or  mapping,  the  meaning  of  certain  terms  used 
in  medical  records  may  not  be  apparent  to  the  VA  provider  requesting  the 
information.  For  example,  unless  the  context  is  clear,  the  meaning  of  the 
term  “cold”  in  a  medical  record  may  be  interpreted  as  meaning  a 
rhinovirus,  a  feeling  of  being  cold,  or  having  chronic  obstructed  lung 
disease. 

•  The  agencies  also  need  to  more  fully  address  data-specific  matters,  such  as 
GCPR’s  reference  modeling,  before  developing  additional  hardware  and 
software.  Once  they  reach  consensus  on  these  issues,  their  agreement 
must  be  clearly  stated  in  a  formalized  document — one  that  is  binding  on 
all  three  partners.  Finally,  for  the  project  to  be  successfully  deployed, 
detailed  plans  on  GCPR’s  system  components  and  tasks  with  clear  project 
parameters  need  to  be  developed.  Until  such  plans  are  developed,  the 
agencies’  GCPR  efforts  cannot  be  fully  assessed. 

•  Privacy  and  security  issues  are  also  continuing  concerns.  DOD  states  in  its 
comments  that  it  does  not  intend  to  delegate  responsibility  for  complying 
with  DOD  and  federal  privacy  and  security  requirements  to  its  local 
facilities.  However,  DOD  does  not  describe  how  it  plans  to  ensure 
compliance,  raising  concerns  such  as  how  unintended  or  unauthorized 
disclosure  or  access  of  information  would  be  prevented  when  the  near- 
term  effort  provides  selected  “data  feeds  from  CHCS  I  [into]  a  database  to 
be  accessed  by  VA.”  Similarly,  VA  generally  describes  how  authorized  VA 
staff  will  access  DOD  medical  records.  However,  we  have  concerns  about 
how  the  two  Departments  will  ensure  the  privacy  and  security  of  patient 
information  given  the  security  weaknesses  in  their  computer  systems, 
which  we  have  repeatedly  reported  on.  In  March  2001,  we  reported  that 
DOD  continues  to  face  significant  personnel,  technical,  and  operational 
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challenges  in  implementing  a  departmentwide  information  security 
program,  and  DOD  management  has  not  carried  out  sufficient  program 
oversight.16  We  included  VA’s  computer  security  in  our  January  2001  High- 
Risk  Series  and,  in  an  accompanying  report,  pointed  out  persistent 
computer  security  weaknesses  that  placed  critical  VA  operations, 
including  health  care  delivery,  at  risk  of  misuse,  fraud,  improper 
disclosure,  or  destruction.16  For  example,  we  found  that  VA  has  not 
adequately  limited  access  granted  to  authorized  users,  managed  user 
identification  and  passwords,  or  monitored  access  activity — weaknesses 
that  VA’s  Inspector  General  recently  testified  on.17 

•  Funding  is  also  a  concern.  VA  states  that  GCPR’s  “success  and  rate  of 
progression  will  depend  to  some  extent  on  the  ability  to  add  partners  and 
available  funding.”  Similarly,  DOD  states  that  GCPR  program  requirements 
will  be  funded  in  accordance  with  overarching  DOD  mission  priorities.  IHS 
also  noted  that  it  faces  competing  demands  for  scarce  resources.  We 
recognize  that  each  agency  has  multiple  priorities.  However,  securing 
adequate  and  stable  funding  and  determining  whether  additional  partners 
are  needed  depends  on  reliable  cost  estimates — which  can  only  be 
determined  with  well-defined  goals  and  detailed  plans  for  achieving  those 
goals.  As  DOD  points  out  in  its  comments,  the  10-year  cost  estimates  for 
GCPR  will  continue  to  be  considered  unreliable  until  clear  mid-  and  long¬ 
term  goals  and  objectives  have  been  established  and  agreed  to  by  the  three 
agencies. 

Each  of  the  three  agencies  also  stated  that  GCPR  may  have  been  judged  by 
the  criteria  used  to  assess  a  standard  information  system  development 
effort  and  that  doing  so  understates  the  complexity  of  their  undertaking. 
While  we  believe  that  the  technology  exists  to  support  GCPR — particularly 
the  new  near-term  effort — we  agree  that  GCPR  presents  unique  and 
difficult  administrative  challenges.  Yet  it  is  this  very  complexity  that  calls 
for  thorough  planning,  interagency  coordination,  and  diligent  oversight  as 
well  as  consistent  and  regular  communication  of  the  project’s  status  and 
progress  to  all  stakeholders. 


16 Information  Security:  Progress  and  Challenges  to  an  Effective  Defense-wide  Information 
Assurance  Program  (GAO-01-307,  Mar.  30,  2001). 

16 Major  Management  Challenges  and  Program  Risks:  Department  of  Veterans  Affairs 
(GAO-Ol-255,  Jan.  2001). 

17 

Testimony  of  Richard  J.  Griffin,  Inspector  General,  Department  of  Veterans  Affairs,  before 
the  House  Committee  on  Veterans’  Affairs,  Subcommittee  on  Oversight  and  Investigations, 
April  4,  2001. 
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Finally,  VA  noted  that  it  would  like  to  discuss  with  us  certain  details  in  our 
report  with  which  it  did  not  fully  agree  but  yet  did  not  disclose  in  its 
comments.  Throughout  the  course  of  the  project — and  particularly  over 
the  past  6  months — we  met  frequently  with  the  agencies  to  provide 
observations  on  our  work  and  discuss  any  concerns  that  were  brought  to 
our  attention.  We  are  committed  to  continuing  to  meet  with  VA,  DOD,  and 
IHS  to  help  in  this  important  endeavor. 


We  are  sending  this  report  to  the  Honorable  Anthony  Principi,  Secretary  of 
Veterans  Affairs;  the  Honorable  Donald  Rumsfeld,  Secretary  of  Defense; 
the  Honorable  Tommy  Thompson,  Secretary  of  Health  and  Human 
Services;  appropriate  congressional  committees;  and  other  interested 
parties.  We  will  also  make  copies  available  to  others  upon  request.  Should 
you  have  any  questions  on  matters  discussed  in  this  report,  please  contact 
me  at  (202)  512-7101.  Other  contacts  and  key  contributors  to  this  report 
are  listed  in  appendix  V. 

^ SL.Q.  QtdJL, 

Stephen  P.  Backhus 
Director,  Health  Care — Veterans’ 
and  Military  Health  Care  Issues 
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Appendix  I:  Scope  and  Methodology 


To  determine  the  status  of  the  GCPR  project,  we  conducted  site  visits  to 
VA,  DOD,  and  IHS  facilities;  interviewed  personnel  at  these  locations, 
representatives  of  nonfederal  health  care  organizations,  and  others 
knowledgeable  about  computerized  linking  of  disparate  health  information 
systems;  and  reviewed  documents  relevant  to  the  project.  We  also 
consulted  with  project  officials  at  various  times  during  our  audit  about  the 
status  of  our  review. 

We  went  to  a  total  of  nine  VA,  DOD,  and  IHS  health  care  facilities  in 
California,  Hawaii,  Indiana,  and  Washington,  D.C.  These  sites  were 
judgmentally  selected  based  on  a  variety  of  factors,  including  diversity  of 
system  capabilities  and  size  and  type  of  facility,  such  as  major  medical 
centers  and  small  community-based  clinics.  Therefore,  they  are  not 
necessarily  representative  of  the  agencies’  facilities.  During  these  site 
visits,  we  spoke  with  a  variety  of  facility  staff — ranging  from  a  DOD 
regional  medical  commander  and  IHS  facility  managers  to  VA 
administrative  personnel — about  their  experiences  using  the  agencies’ 
existing  health  information  systems.  We  also  asked  them  about  what 
additional  information  and  system  features  they  consider  to  be  important 
in  treating  patients  and  conducting  population-based  research.  Further,  we 
talked  with  facility  IT  technicians  and  administrators  about  their  systems’ 
capabilities  and  the  technical  requirements  for  developing  the  GCPR 
interface,  and  we  discussed  the  potential  effect  the  interface  might  have 
on  current  operations  and  systems. 

We  interviewed  VA,  DOD,  and  IHS  officials,  primarily  from  the  agencies’ 
headquarters,  involved  directly  in  the  GCPR  project  to  obtain  specific 
information  about  the  project’s  day-to-day  operations  and  management, 
including  timelines,  costs,  and  technical  matters.  We  also  interviewed 
personnel  from  the  two  primary  GCPR  contractors — Litton/PRC  in 
McLean,  Virginia,  and  Battelle  Memorial  Institute  of  Columbus,  Ohio — on 
the  status  of  the  interface  development,  particularly  regarding  the 
reference  modeling.  We  also  talked  with  agency  representatives  on  the 
GCPR  Board  of  Directors  and  Executive  Committee  about  the  oversight  of 
the  project. 

To  obtain  additional  perspectives  about  the  development  of  computerized 
patient  record  systems,  we  talked  with  recognized  leaders  in  the  field  and 
visited  selected  private  sector  facilities,  including  Kaiser  Permanente, 
Aurora  Healthcare  of  Wisconsin,  and  the  Regenstrief  Institute  of  the 
University  of  Indiana  in  Indianapolis.  We  also  talked  with  officials  from 
the  National  Committee  on  Vital  and  Health  Statistics  regarding  privacy 
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and  security  issues  and  the  status  of  the  development  of  HIPAA 
regulations. 

Finally,  we  reviewed  many  GCPR  project  documents.  These  included 
technical  plans,  such  as  the  project’s  draft  privacy  and  security  plan, 
deployment  plans,  and  other  planning  documents;  cost  analyses;  and 
Board  of  Directors  and  Executive  Committee  meeting  minutes;  and  other 
relevant  project  documents.  We  conducted  our  review  between  March 
2000  and  April  2001  in  accordance  with  generally  accepted  government 
auditing  standards. 
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Appendix  II:  Comments  From  the 
Department  of  Veterans  Affairs 


THE  SECRETARY  OF  VETERANS  AFFAIRS 
WASHINGTON 

April  09,  2001 


Mr.  Stephen  P.  Backhus,  Director 

Health  Care — Veterans  and  Military  Health  Care  Issues 

U.  S.  General  Accounting  Office 

441  G  Street,  NW 

Washington,  DC  20548 

Dear  Mr.  Backhus: 

This  responds  to  your  draft  report,  COMPUTER-BASED  PATIENT 
RECORDS:  Better  Planning  and  Oversight  By  VA,  DOD,  and  IHS  Would 
Enhance  Health  Data  Sharing  (GAO-01-459).  I  agree  with  the  General 
Accounting  Office  (GAO)  that  the  Departments  of  Veterans  Affairs  (VA)  and 
Defense  (DOD)  and  the  Indian  Health  Service  (IHS)  need  to  improve  their  efforts 
to  create  a  Government  Computer-Based  Patient  Record  (GCPR).  The  GCPR 
will  enhance  all  organizations’  ability  to  rapidly  share  health  information  to  best 
serve  our  veterans,  service  members,  and  Native  Americans. 

As  the  Congress  and  GAO  already  recognize,  the  challenge  requires 
vision,  practical  application,  and  perhaps  most  importantly,  an  implementation 
plan.  As  GAO  realizes,  both  VA  and  the  DOD  are  vast  agencies  with  long¬ 
standing  and  independently  developed  health  information  systems.  I  concur  with 
GAO  that  to  successfully  create  the  GCPR,  the  three  entities  must  agree  to 
designate  a  lead  with  decisionmaking  authority.  I  will  work  closely  with  the 
Secretary  of  Defense  and  the  Director,  IHS  to  establish  that  lead  entity  with  a 
clear  line  of  authority.  Three  enclosures  are  provided  to  furnish  additional 
details.  Enclosure  #1  addresses  GAO’s  specific  recommendations,  and 
Enclosure  #2  provides  details  on  the  GCPR  Near-Term  (FY01)  Solution. 
Enclosure  #3  is  a  fact  sheet  that  we  understand  mirrors  the  views  submitted  by 
DOD  and  IHS. 

We  are  in  a  new  Millennium  and  at  the  threshold  of  an  information 
technology  that  is  evolving  at  an  immeasurable  pace.  Creating  a  GCPR  will  not 
only  allow  VA,  DOD,  and  IHS  to  serve  our  special  populations,  but  will  also  be  a 
seminal  step  toward  advancing  health  care  delivery  to  all  Americans. 

Sincerely  yours, 


Enclosures 
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Enclosure  (1) 

DEPARTMENT  OF  VETERANS  AFFAIRS  COMMENTS 
TO  GAO  DRAFT  REPORT, 

COMPUTER-BASED  PA  TIENT  RECORD:  Better  Planning  and 
Oversight  By  VA,  DOD,  and  IHS  Would 
Enhance  Health  Data  Sharing 

(GAO-01  -459) 

GAO  recommends  that  I  along  with  the  Secretary  of  DOD  and  the 
Director  of  IHS  direct  our  health  CIOs  to  take  the  following  actions 
for  the  interim  effort: 

•  Designate  a  lead  entity  with  final  decisionmaking  authority 
and  establish  a  clear  line  of  authority. 

Concur  -  I  will  meet  with  the  Secretary  of  Defense  and  the  Director,  Indian 
Health  Service  to  establish  a  lead  entity  that  will  have  decisionmaking  authority 
for  our  three  organizations.  Once  established,  that  entity  will  have  a  clear  line  of 
authority  over  all  GCPR  development  activities. 

•  Create  comprehensive  and  coordinated  plans — which 
include  an  agreed  upon  mission,  clear  goals,  objectives, 
and  performance  measures  and  capitalize  on  existing 
medical  IT  capabilities— to  ensure  that  the  agencies  can 
share  comprehensive,  accurate,  and  secure  patient  health 
data. 

Concur  -  I  will  direct  the  Veterans  Health  Administration  CIO,  in  collaboration 
with  VA’s  Departmental  CIO,  to  prepare  comprehensive  and  coordinated  plans 
for  GCPR.  Under  the  oversight  of  the  lead  entity,  these  plans  will  match 
missions,  goals,  objectives,  and  performance  measures  to  capitalize  on  existing 
medical  IT  capabilities  as  well  as  assist  all  three  agencies’  ability  to  share 
comprehensive,  accurate,  and  secure  patient  health  data. 

GAO  also  recommends  that  decisions  about  the  broader,  long-term 
GCPR  project  be  reassessed,  based  on  the  results  of  the  interim 
effort.  If  the  Secretaries  of  VA  and  DOD  and  the  Director  of  IHS 
decide  to  continue  with  the  broader  effort,  they  should  direct  their 
health  CIOs  to  apply  the  principles  of  sound  project  management 
delineated  in  GAO’s  recommendations  for  the  interim  effort. 

Concur  -  I  anticipate  that  the  integration  testing  for  our  near-term  solution  will  be 
completed  by  September  30,  2001,  providing  for  an  initial  operating  capability  by 
October  31 ,  2001 .  Based  on  the  results,  decisions  about  the  broader,  long-term 
GCPR  project  will  be  reassessed.  The  long-term  strategy  will  depend,  to  some 
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Enclosure  (1) 

DEPARTMENT  OF  VETERANS  AFFAIRS  COMMENTS 
TO  GAO  DRAFT  REPORT, 

COMPUTER-BASED  PATIENT  RECORD:  Better  Planning  and 
Oversight  By  VA,  DOD,  and  IHS  Would 
Enhance  Health  Data  Sharing 
(GAO-0 1-459) 

(Continued) 

extent,  on  advances  in  medical  informatics,  standards  development,  and  the 
ability  to  bring  in  additional  partners. 

Beyond  the  near-term  solution,  two  additional  phases  of  the  GCPR  project  are 
envisioned. 

•  Phase  II  -  Complete  the  middle-term  effort  to  produce  the  GCPR 
framework  that  allows  disparate  systems,  in  both  the  public  and  private 
sectors,  to  share  health  information.  Its  success  and  rate  of  progression 
will  depend  to  some  extent  on  the  ability  to  add  partners  and  available 
funding. 

•  Phase  III  -  Build  the  longer-term  effort  to  work  with  the  public  and  private 
sector  national  health  information  standards  development  activities  to 
develop  similar,  standards-based  health  information  systems  that  may  be 
used  by  both  the  public  and  private  sectors.  Resources  for  this  effort  will 
need  to  come  from  both  sectors. 


Additional  Comments: 

VA  would  also  like  to  share  several  points  to  provide  a  foundation  for  assessing 
GCPR  and  its  progress.  A  longitudinal  record  covering  service  members  from 
their  start  of  service  through  their  care  with  VA  consists  of  three  primary 
elements.  They  are: 

•  The  Department  of  Defense’s  (DOD)  core  health  information  system 
(currently  the  Composite  Health  Care  System  (CHCS)  I;  the  future  is  CHCS 

ii); 

•  GCPR  for  handling  the  transfer  and  mediation  of  data  among  DOD,  VA  and 
the  Indian  Health  Service  (IHS);  and, 

•  VA’s  core  health  information  system  (currently  the  Veterans  Health 
Information  Systems  and  Technology  Architecture  (VistA);  the  future  is  next 
generation  VistA;  i.e.,  HealtheVet). 

While  early  project  documents  indicated  that  GCPR  would  permit  health  care 
professionals  to  “share  clinical  information  via  a  comprehensive,  lifelong  medical 
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DEPARTMENT  OF  VETERANS  AFFAIRS  COMMENTS 
TO  GAO  DRAFT  REPORT, 

COMPUTER-BASED  PATIENT  RECORD:  Better  Planning  and 
Oversight  By  VA,  DOD,  and  IHS  Would 
Enhance  Health  Data  Sharing 

(GAO-01-459) 

(Continued) 

record,’’  the  realities  of  the  challenges  have  led  to  a  scaling  back  of  the  initial 
vision. 

As  discussed  with  GAO,  a  new  near-term  solution  has  been  developed  to 
address  the  concerns  GAO  raises  in  its  report.  The  new  near-term  solution  uses 
the  GCPR  framework,  provides  a  significant  amount  of  information  in  a  sortable 
format  for  clinician  use,  and  is  funded  for  fiscal  year  2001 .  This  solution  will 
provide  current  and  historical  data  feeds  from  CHCS  I  on  selected  data  types  for 
active  duty,  retirees,  and  separated  personnel  into  the  GCPR  framework  and 
data  base  for  VA  access.  Current  data  that  DOD  will  send  to  VA  will  include 
laboratory  results,  radiology  results,  outpatient  pharmacy,  admission,  discharge, 
and  transfer  messages,  and  patient  demographics.  DOD  will  transmit  the  current 
data  to  VA  in  near-real-time.  Using  a  pre-determined  schedule,  we  will  extract 
and  transmit  historical  data  feeds. 
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Government  Computer-based  Patient  Record  (GCPR)  —  Near-Term  (FY01) 
Solution 

DOD  and  VA  are  working  very  closely  on  establishing  the  appropriate 
technical  architecture  to  extract  electronic  health  information  from  the  DOD 
Composite  Health  Care  System  (CHCS  I)  and  transmit  this  information  to  a 
shared  repository  where  this  medical  data  is  available  for  use  by  VA.  VA  will 
make  this  data  accessible  to  VA  clinical  care  providers  as  part  of  the  veteran's 
electronic  medical  record  within  its  Veterans  Health  Information  Systems  and 
Technology  Architecture  (VistA)  health  information  system. 

Representatives  from  DOD,  VA,  Indian  Health  Service,  Litton  PRC,  and 
Science  Application  International  Corporation  met  the  week  of  March  1 9,  2001 ,  to 
evaluate  the  information  exchange  architecture  alternatives,  analyze  technical 
risks/capability  tradeoffs,  and  develop  costs  and  a  schedule  for  the  most  viable 
alternatives.  The  solution  agreed  to  by  all  parties  utilizes  the  GCPR  framework, 
provides  a  significant  amount  of  information  in  a  sortable  format  for  use  by 
clinicians,  facilitates  future  IHS  participation,  and  is  funded  for  FY01 . 

The  solution  will  provide  current  and  historical  data  feeds  from  CHCS  I  to 
the  GCPR  Framework  Node  on  selected  data  types  for  active  duty,  retired,  and 
separated  service  members.  Medical  data  on  non-veterans  will  not  be  sent  as 
part  of  this  solution.  Current  data  that  will  be  sent  in  Health  Level  Seven  (HL7) 
like  messages  are  laboratory  results,  radiology  results,  outpatient  pharmacy, 
admission,  discharge,  and  transfer  messages,  and  patient  demographics. 

Current  data  will  be  sent  in  near-real-time  transmission  from  DOD  to  the  GCPR 
Framework  Node  for  storage  in  the  GCPR  Repository.  These  current  data  feeds 
will  use  existing  event  triggers  within  CHCS  I  to  send  messages  to  the  shared 
repository. 

Historical  medical  information  will  be  extracted  from  CHCS  I  systems  and 
transmitted  to  the  GCPR  Framework  Node,  for  storage  in  the  GCPR  Repository, 
using  batch  transmission  techniques  that  will  facilitate  the  handling  of  this  bulk 
information  and  eliminate  possible  performance  impacts  on  the  existing  CHCS  I 
systems. 

The  GCPR  Repository  will  allow  access  to  medical  information  during  VA 
care  and  will  also  provide  for  potential  future  use  for  aggregate  analysis  if 
necessary.  While  final  sizing  estimates  are  incomplete,  we  do  know  that  this 
repository  of  medical  data  will  be  large  enough  to  contain  medical  record 
information  on  the  approximately  220,000  service  members  separating  each 
year,  in  addition  to  the  historical  information  on  separated  or  retired  service 
members  who  have  had  medical  data  in  CHCS  I  since  it  became  fully  operational 
in  the  1990’s.  Work  is  in  progress  to  accurately  determine  initial  capacity  needed 
to  store  data  from  CHCS  I. 

VHA  clinical  staff  who  are  authorized  to  view  medical  records  will  have 
access  to  the  DOD  data  stored  in  the  GCPR  Repository  by  using  the  VistA 
Computer  Patient  Record  System  (CPRS)  Remote  Data  Views  application. 

When  a  patient  with  DOD  data  is  selected  in  CPRS,  the  CPRS  facility  list  will 

1 


Page  28 


GAO-Ol-459  Government  Computer-Based  Patient  Records 


Appendix  II:  Comments  From  the  Department 
of  Veterans  Affairs 


Enclosure  (2) 


include  a  selection  that  will  alert  the  clinician  that  the  patient  has  DOD  data 
available  for  display.  If  the  clinician  wishes  to  see  that  data,  a  remote  procedure 
call  will  be  issued  from  the  initiating  site  to  the  VHA  Primary  Host,  just  as  is  done 
for  data  from  other  VA  facilities.  The  VHA  Primary  Host  serves  as  a  single  point 
of  access  to  the  shared  GCPR  Repository,  using  the  standards-based  CORBA 
Clinical  Observations  Access  Service  (COAS)  already  developed  for  the  GCPR 
framework  to  request  data  from  the  GCPR  Repository. 

Positioning  the  VHA  Primary  Host  between  the  shared  GCPR  Repository 
and  VA  facilities  virtually  eliminates  the  need  to  implement  new  software  at  the 
local  VA  medical  care  facilities  to  support  this  solution.  Components  originally 
planned  for  use  in  the  original  GCPR  Pilot  project,  such  as  the  COAS 
client/server  software,  clinical  templates,  and  the  MUMPS  Object  Request  Broker 
(ORB),  will  be  installed  on  this  VHA  Primary  Host  and  used  for  communication 
with  the  GCPR  repository.  This  reuse  of  existing  software  on  both  DOD  and 
VHA  systems  creates  the  ability  to  deliver  a  short-term  solution  to  provide  DOD 
medical  data  to  VA  by  the  end  of  the  year.  The  current  target  for  this  near-term 
solution  is  to  complete  integration  testing  by  September  30,  2001,  and  to  have 
initial  operating  capability  by  October  31 ,  2001 . 
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Near  Term  (FY01)  Solution 


DoD-VHA  Shared  GCPR 
Data  Repository 


Location  TBD 
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Fact  Sheet  on  Government  Computer-Based  Patient  Record  (GCPR) 

In  general,  VA  concurs  with  the  overall  GAO  draft  report  and  agrees  that  there 
should  be  a  lead  entity,  a  comprehensive  and  coordinated  plan,  and  a  reassessment  of 
the  long-term  project.  As  you  are  aware,  the  three  agencies  began  more  aggressive 
planning  and  oversight  last  fall.  It  is  VA’s  understanding  that  GAO  agrees  that  this 
change  should  result  in  a  much  better  defined  future  for  GCPR,  a  stronger  management 
of  the  GCPR  effort,  a  valuable  near-term  solution,  and  a  greater  assurance  of  a 
successful  outcome. 

There  are  several  points  that  need  to  be  made  in  order  to  provide  the  appropriate 
foundation  for  assessing  GCPR  and  its  progress. 

First,  while  GCPR  is  a  very  important  effort,  its  role  is  not  to  carry  the  whole  weight 
for  the  service  members’  health  records  and  the  related  health  information  systems 
within  each  of  the  three  agencies.  A  longitudinal  record  covering  service  members  from 
their  start  of  service  through  their  care  with  VA  consists  of  three  primary  elements: 

•  DOD’s  core  health  information  system  (currently  is  the  Composite  Health  Care 
System  (CHCS)  I;  future  is  CHCS  II), 

•  GCPR  for  handling  the  transfer  and  mediation  of  data  among  DOD,  VA  and  the 
IHS,  and 

•  VA’s  core  health  information  system  (currently  is  UstA;  future  is  next  generation 
VistA  -  HealtheVet). 

GCPR  also  has  a  critical  role  in  our  efforts  to  share  information  with  the  private  sector. 

Second,  as  has  been  discussed  with  GAO,  the  DOD,  VA,  and  IHS  have  developed  a 
new  and  more  robust  near-term  solution  that  addresses  many  of  the  concerns  GAO 
raised  in  its  report.  This  new-near  term  solution  utilizes  the  GCPR  framework,  provides 
a  significant  amount  of  information  in  a  sortable  format  for  use  by  clinicians,  and  is 
funded  for  FY01 .  It  will  provide  current  and  historical  data  feeds  from  CHCS  I  on 
selected  data  types  for  active  duty,  retirees,  and  separated  personnel  into  the  GCPR 
framework  and  database  to  be  accessed  by  VA.  Current  data  that  will  be  sent  from 
DOD  to  VA  will  include  laboratory  results,  radiology  results,  outpatient  pharmacy, 
admission,  discharge,  and  transfer  messages,  and  patient  demographics.  Current  data 
will  be  sent  in  near-real-time  transmission  from  DOD  to  VA.  Historical  data  feeds  will  be 
extracted  and  transmitted  on  a  pre-determined  schedule.  The  current  target  for  this 
near-term  solution  is  to  complete  integration  testing  by  September  30,  2001,  and  to 
have  initial  operating  capability  by  October  31, 2001. 

With  respect  to  the  longer-term  strategy,  the  three  agencies  are  reassessing  and  will 
firm  up  that  longer-term  strategy  quickly.  The  three  agencies  anticipate  that  the  longer- 
term  strategy  will  depend,  to  some  extent,  on  advances  in  medical  informatics, 
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standards  development,  and  the  three  agencies’  ability  to  bring  in  additional  partners. 
The  three  agencies  envision  two  additional  phases  of  the  GCPR  project  beyond  the 
near-term  solution: 

•  Phase  II  -  The  three  agencies  will  complete  the  middle-term  effort  to  produce  the 
GCPR  framework  that  allows  disparate  systems,  in  both  the  public  and  private 
sector,  to  share  health  information.  Its  success  and  rate  of  progression  will 
depend  to  some  extent  on  our  ability  to  bring  in  additional  partners  and  available 
funding. 

•  Phase  III  -  For  the  longer-term,  we  will  work  with  the  public  and  private  sector 
national  health  information  standards  development  activities  to  develop  similar, 
standards-based  health  information  systems  that  could  be  used  by  both  the 
public  and  private  sectors.  Resources  for  this  effort  will  need  to  come  from  both 
the  public  and  private  sector. 

The  development  of  GCPR  is  a  very  difficult  design  and  development  effort  that  has 
never  been  done  before.  GCPR  has  the  reduced  predictability  and  many  of  the 
characteristics  and  challenges  associated  with  research  and  development  efforts.  To 
judge  it  by  the  same  measures  used  for  assessing  a  standard  information  system 
development  effort  is  to  underestimate  the  challenge  that  the  three  agencies  have  taken 
on. 

To  facilitate  the  very  open  process  necessary  for  three  federal  agencies  to  develop  a 
complex  product  such  as  the  GCPR,  it  is  essential  that  many  concepts  and  ideas  be 
developed.  These  concepts  must  be  given  wide  dissemination  in  order  to  elicit  points  of 
view,  clarify  requirements,  and  identify  potential  risks.  As  part  of  our  reassessment  of 
the  long-term  GCPR  project,  VA  will  work  closely  with  DOD  and  IHS  to  establish  an 
agreed  upon  mission,  goals,  objectives,  and  performance  measures,  while  still 
encouraging  an  atmosphere  of  open  exploration  necessary  for  such  a  complex  and 
evolutionary  endeavor. 

All  three  agencies  are  facing  many  competing  demands  for  their  resources.  The 
three  agencies  are  firmly  committed  to  the  GCPR  effort,  but  need  to  use  resources 
carefully.  DOD  and  VA  will  fully  fund  the  near-term  solution.  The  three  agencies  intend 
to  explore  other  funding  options  for  those  elements  of  GCPR  that  also  would  benefit  the 
private  sector. 

In  response  to  your  proposed  recommendation  with  respect  to  improving  planning 
and  oversight,  the  three  agencies  agree  with  GAO  and  that  has  begun  as  GAO 
acknowledges  in  its  draft  report.  The  three  agencies  are  committed  to  maintaining 
aggressive  planning  and  oversight  until  GCPR  is  a  success. 

Finally,  while  VA  agrees  with  the  recommendations  and  have  focused  on  the  major 
points,  there  are  a  number  of  more  detailed  items  we  do  not  fully  agree  with  in  the  draft 
report.  We  would  be  happy  to  meet  with  you  to  discuss  them  at  your  convenience. 
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As  in  the  past,  the  three  agencies  look  forward  to  working  with  GAO  on  this  issue. 
Collaboration  will  be  key  as  the  three  agencies  move  to  implement  the  near  term 
solution  for  sharing  DOD  information  with  VA  and  to  develop  the  longer  term  strategies 
that  will  both  enable  information  sharing  among  disparate  health  information  systems 
across  the  nation  and  result  in  more  similar,  standardized  health  information  systems  for 
the  public  and  private  sectors.  Collaboration  among  the  three  agencies  has  been  a  key 
element  in  the  progress  to  date  and  is  essential  to  the  future  of  GCPR  and  other 
information  system  efforts  of  common  interest. 

Collaboration  with  the  Department  of  Defense  and  the  Indian  Health  Service  is  a  high 
priority  for  the  Department  of  Veterans  Affairs.  Your  observations  have  been  helpful  in 
assisting  us. 
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THE  ASSISTANT  SECRETARY  OF  DEFENSE 
WASHINGTON,  D.  C.  20301-1200 


HEALTH  AFFAIRS 

APR  5  2001 

Stephen  P.  Backhus 

Director,  Health  Care  -  Veterans  and  Military  Health  Care  Issues 
United  States  General  Accounting  Office 
Washington,  DC  20548 

Dear  Mr.  Backhus: 

This  is  the  Department  of  Defense  (DoD)  response  to  the  GAO  draft  report,  COMPUTER- 
BASED  PATIENT  RECORDS:  Better  Planning  and  Oversight  Bv  VA.  DOD  and  MS  Would 
Enhance  Health  Data  Sharing,  dated  March  15,  2001  (GAO  Code  101646/OSD  Case  3057). 


In  general,  the  DoD  concurs  with  the  recommendations  in  the  GAO  draft  report  and  agrees 
there  should  be  a  lead  entity,  a  comprehensive  and  coordinated  plan,  and  a  reassessment  of  the 
long-term  project.  As  you  are  aware,  we  began  more  aggressive  planning  and  oversight  last  Fall 
by  more  direct  involvement  of  the  medical  Chief  Information  Officer  (CIO)  in  the  Government 
Computer-Based  Patient  Record  (GCPR)  governance  process.  We  also  plan  to  include  the 
Military  Health  System  (MHS)  Information  Management  Committee  in  GCPR  oversight.  It  is 
our  understanding  that  you  agree  that  this  change  should  result  in  a  much  better  defined  future 
for  GCPR,  a  stronger  management  of  the  GCPR  effort,  a  valuable  near-term  solution,  and  a 
greater  assurance  of  a  successful  outcome. 

There  are  several  points  that  need  to  be  made  in  order  to  provide  the  appropriate  foundation 
for  assessing  GCPR  and  its  progress. 

First,  while  GCPR  is  a  very  important  effort,  its  role  is  not  to  carry  the  whole  weight  for  the 
service  members’  health  records  and  the  related  health  information  systems  within  each  of  the 
three  agencies.  A  longitudinal  record  covering  service  members  from  their  start  of  service 
through  their  care  with  the  VA  consists  of  three  primary  elements: 

•  DoD’s  core  health  information  system.  Currently,  this  system  is  the  Composite  Health 
Care  System  (CHCS)  I;  future  is  CHCS  II; 

•  GCPR  for  handling  the  transfer  and  mediation  of  data  between  DoD,  the  Department  of 
Veterans  Affairs  (VA),  and  the  Indian  Health  Service  (IHS);  and 

•  VA’s  core  health  information  system  (currently  is  VistA;  future  is  next  generation  VistA 
-  HealtheVet). 

GCPR  also  has  a  critical  role  in  our  efforts  to  share  information  with  the  private  sector. 
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Second,  as  has  been  discussed  with  you,  DoD,  VA,  and  IHS  have  developed  a  new  and  more 
robust  near-term  solution  that  addresses  many  of  the  concerns  you  raised  in  your  report.  This 
new  near-term  solution  utilizes  the  GCPR  framework,  provides  a  significant  amount  of 
information  in  a  sortable  format  for  use  by  clinicians,  and  is  funded.  It  will  provide  current  and 
historical. data  feeds  from  CHCS  I  on  selected  data  types  for  active  duty,  retirees,  and  separated 
personnel  into  the  GCPR  framework  and  the  database  to  be  accessed  by  VA.  Current  data  that 
will  be  sent  from  DoD  to  the  VA  will  include  laboratory  results,  radiology  results,  outpatient 
pharmacy,  admission,  discharge,  and  transfer  messages,  and  patient  demographics.  Current  data 
will  be  sent  in  near  real-time  transmission  from  DoD  to  VA.  Historical  data  feeds  will  be 
extracted  and  transmitted  on  a  pre-determined  schedule.  The  current  target  for  this  near-term 
solution  is  to  complete  integration  testing  by  September  30, 2001,  and  to  have  initial  operating 
capability  by  October  31,  2001. 

As  the  draft  GAO  report  recommends,  DoD,  working  closely  with  VA  and  IHS,  will 
reassess  the  GCPR  mid-  and  long-term  strategies  in  concert  with  the  implementation  of  the  near- 
term  solution.  We  anticipate  that  the  longer-term  strategy  will  depend,  to  some  extent,  on 
advances  in  medical  informatics,  standards  development,  and  our  ability  to  bring  in  additional 
federal  and  industry  partners.  We  envision  two  potential  additional  phases  of  the  GCPR  project 
beyond  the  near-term  solution: 

•  Phase  II  -  In  concert  with  other  federal  agency  and  industry  partners,  continue  to 
participate  in  the  effort  to  develop  a  GCPR  framework  that  allows  disparate  systems  to 
share  health  information.  Its  success  and  rate  of  progression  will  depend,  to  some  extent, 
on  our  ability  to  bring  in  additional  partners  and  available  funding. 

•  Phase  HI  -  For  the  longer-term,  we  must  work  with  the  public  and  private  sector  national 
health  information  standards  development  activities  to  develop  standards-based  health 
information  systems  that  could  be  used  by  both  the  public  and  private  sectors.  Resources 
and  agreement  on  national  health  information  standards  will  need  to  come  from  both  the 
public  and  private  sector. 

The  development  of  GCPR  is  a  very  difficult  design  and  development  effort  that  has  never 
been  done  before.  It  maintains  a  reduced  predictability  and  many  of  the  characteristics  and 
challenges  associated  with  research  and  development  efforts.  To  judge  it  by  the  same  measures 
used  for  assessing  a  standard  information  system  development  effort  greatly  underestimates  the 
challenge  that  the  three  agencies  have  undertaken. 

To  facilitate  the  very  open  process  necessary  for  three  federal  agencies  to  develop  a  complex 
product  such  as  the  GCPR,  it  is  essential  that  many  concepts  and  ideas  be  developed.  These 
concepts  must  be  given  wide  dissemination  in  order  to  elicit  points  of  view,  clarify  requirements, 
and  identify  potential  risks.  As  part  of  our  reassessment  of  the  long-term  GCPR  project,  we  will 
work  closely  with  the  VA  and  IHS  in  establishing  a  common  mission,  goals,  objectives,  and 
performance  measures,  while  continuing  to  encourage  an  atmosphere  of  open  exploration  and 
discussion  necessary  for  such  a  complex  and  evolutionary  endeavor. 
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All  three  agencies  are  facing  many  competing  demands  for  their  resources.  We  are  firmly 
committed  to  the  GCPR  effort,  but  we  need  to  use  our  resources  carefully.  We  will  fund  the 
near-term  solution  and  intend  to  explore  other  funding  options  for  mid-  and. long-term  GCPR 
efforts  that  will  potentially  include  other  agencies  and  the  private  sector. 

With  regard  to  your  proposed  recommendation  that  the  health  CIOs  become  more  involved 
in  improving  planning  and  oversight,  the  DoD  medical  CIO  did,  in  fact,  become  more  directly 
involved  in  the  GCPR  governance  process  last  Fall.  The  three  agencies  are  committed  to 
maintaining  aggressive  planning  and  oversight  of  the  GCPR  project. 

Finally,  while  we  have  focused  on  the  major  points,  there  are  additional  comments  provided 
in  enclosure  2.  We  look  forward  to  discussing  these  items  with  you  at  your  convenience. 

As  in  the  past,  we  look  forward  to  working  with  GAO  on  this  issue.  Collaboration  will  be 
key  as  we  move  to  implement  the  near-term  solution  for  sharing  DoD  information  with  VA. 
Ultimately,  we  will  develop  the  longer-term  strategies  that  both  enable  information  sharing 
among  disparate  health  information  systems  across  the  nation,  and  create  more  similar, 
standardized  health  information  systems  for  the  public  and  private  sectors.  Teamwork  among 
the  three  agencies  has  been  a  key  element  in  the  progress  to  date,  and  is  essential  to  the  future  of 
GCPR  and  other  information  system  efforts  of  common  interest. 

Collaboration  with  the  Department  of  Veterans  Affairs  is  a  high  priority  for  the  MHS.  Your 
observations  have  been  helpful  in  assisting  us.  Please  feel  free  to  direct  any  questions  to  my 
project  officers  on  this  matter,  Lt  Col  Marie-Jocelyne  Charles  (functional)  at  (703)  681-8789  or 
Mr.  Gunther  J.  Zimmerman  (GAO/IG  Liaison)  at  (703)  681-7889. 


J.  Jarrett  Clinton,  MD,  MPH 
Acting  Assistant  Secretary 


Enclosures: 

1 .  Response  to  GAO  Recommendations 

2.  Additional  Comments 
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Enclosure  1: 

Response  to  Recommendations  of 
GAO  Draft  Report  GAO-Ol-459, 

“COMPUTER-BASED  PATIENT  RECORDS : 

Better  Planning  and  Oversight  By  VA,  DoD  and  IHS 
Would  Enhance  Health  Data  Sharing.” 

RECOMMENDATION  1:  The  Secretaries  of  VA  and  DoD  and  the  Director  of  IHS  direct  their 
health  CIO’s  to  designate  a  lead  entity  with  final  decision  making  authority  and  establish  a  clear 
line  of  authority  (p.  17/Draft  Report). 

PROPOSED  DOD  RESPONSE:  Concur. 


RECOMMENDATION  2:  The  Secretaries  of  VA  and  DoD  and  the  Director  of  IHS  direct  their 
health  CIO’s  to  create  comprehensive  and  coordinated  plans-which  include  an  agreed  upon 
mission,  clear  goals,  objectives,  and  performance  measures  and  capitalize  on  existing  medical  IT 
capabilities  to  ensure  that  the  agencies’  can  share  comprehensive,  accurate,  and  secure  patient 
health  data.  (p.  17/Draft  Report) 

PROPOSED  DOD  RESPONSE:  Concur. 


RECOMMENDATION  3:  Decisions  about  the  broader,  long-term  GCPR  project  be  reassessed, 
based  on  results  of  the  interim  effort.  If  the  Secretaries  of  VA  and  DoD  and  the  Director  of  IHS 
decide  to  continue  with  the  broader  effort,  they  should  direct  their  health  CIO’s  to  apply  the 
principles  of  sound  project  management  delineated  in  our  recommendations  for  the  interim 
effort,  (p.  17/Draft  Report) 

PROPOSED  DOD  RESPONSE:  Concur. 

Attachment  1  to  Memo. 
GAO  Draft  Report. 
page  1  of  1 
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Enclosure  2: 

Additional  Comments  on  the 
GAO  Draft  Report  GAO-0 1-459, 

“COMPUTER-BASED  PATIENT  RECORDS: 

Better  Planning  and  Oversight  By  VA,  DoD  and  IHS 
Would  Enhance  Health  Data  Sharing.” 

In  addition  to  the  remarks  in  the  letter,  DoD  would  like  to  provide  the  following  additional 

comments: 

1.  Near-Term  Solution 

The  DoD  and  VHA  medical  CIOs  are  more  directly  involved  in  the  GCPR  governance 
process.  They,  as  well  as  the  IHS  CIO,  are  working  closely  to  establish  the  appropriate 
technical  architecture  to  extract  electronic  health  information  from  the  DoD  Composite 
Health  Care  System  (CHCS)  and  transmit  this  information  to  the  VA  for  inclusion  in  the 
veterans  electronic  health  record  system,  VistA.  The  DoD,  VA,  IHS,  Litton  PRC,  and 
Science  Application  International  Corporation  met  the  week  of  March  19,  2001,  to  evaluate 
the  information  exchange  architecture  alternatives,  analyze  technical  risks/capability 
tradeoffs,  and  develop  cost  and  schedule  for  the  most  viable  alternatives.  The  solution  agreed 
to  by  all  parties  utilizes  the  GCPR  framework,  provides  a  significant  amount  of  information 
in  a  sortable  format  for  use  by  clinicians,  facilitates  IHS  participation,  and  is  funded  for 
FY01. 

The  near-term  solution  will  provide  current  and  historical  data  feeds  from  CHCS  I  on 
selected  data  types  for  active  duty,  retirees,  and  separated  personnel  into  the  GCPR 
framework  and  database  to  be  accessed  by  VA.  Current  data  that  will  be  sent  in  Health  Level 
Seven  (HL7)  like  messages  are  laboratory  results,  radiology  results,  outpatient  pharmacy, 
admission,  discharge,  and  transfer  messages,  and  patient  demographics.  Current  data  will  be 
sent  in  near  real-time  transmission  from  DoD  to  VA.  For  example,  data  collected  during  the 
day  will  be  available  for  use  by  VA  the  next  morning.  Historical  data  feeds  will  be  extracted 
and  transmitted  on  a  pre-determined  schedule.  While  not  perfect,  the  data  provided 
electronically  should  be  a  substantial  improvement  for  physicians  making  medical  decisions 
and  enhance  the  continuity  of  care  for  veterans.  The  current  target  for  this  near-term  solution 
is  to  complete  integration  testing  by  September  30,  2001,  and  to  have  initial  operating 
capability  by  October  31,  2001. 

2.  Funding 

The  ten  year  cost  estimates  for  the  GCPR  are  considered  to  be  unreliable  until  clear  mid-  and 
long-term  goals  and  objectives  for  the  GCPR  are  established  and  agreed  to  by  DoD,  VA,  and 
IHS.  Pursuant  to  agreement  on  the  mid-  and  long-term  goals  and  objectives,  GCPR  program 
requirements  will  be  resourced  through  the  DoD  Planning,  Programming,  and  Budgeting 
System  (PPBS)  process  in  accordance  with  overarching  DoD  mission  priorities. 
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3.  Security 

GCPR  will  be  designed  to  comply  with  DoD  and  Federal  privacy  and  security  requirements. 
It  is  not  the  intent  of  DoD  to  delegate  primary  responsibility  for  ensuring  privacy  and 
security  of  the  GCPR  to  over  a  thousand  local  facilities. 

4.  Composite  Health  Care  System  (CHCS)  I 

CHCS  I  is  a  clinically-focused  system.  It  supports  physician  order  entry  and  results  retrieval, 
along  with  access  to  all  clinical  information  in  radiology,  pharmacy,  laboratory,  and  clinical 
dietetics.  In  its  report.  Defense  Achieves  Worldwide  Deployment  of  Composite  Health  Care 
System ,  GAO/AIMD-96-39,  dated  April  1996,  GAO  states  "CHCS  I  is  a  comprehensive 
medical  information  system  that  Defense  has  developed  to  provide  automated  support  to  its 
military  medical  treatment  facilities."  GAO  further  stated,  "CHCS  I  supports  high-volume 
workloads  generated  by  numerous  physicians  and  other  health  care  professionals  using  the 
system  simultaneously  and  enhances  communications  within  and  among  medical  treatment 
facilities."  CHCS  I  was  not  designed  to  include  information  on  personnel  when  they  enter 
service,  information  on  reservists,  or  information  on  TRICARE  provider  care. 

5.  Members  of  the  Board  of  Directors 

The  Board  of  Directors  for  the  GCPR  project  consisted  of  the  VA  Deputy  Under  Secretary 
for  Health,  the  Deputy  Surgeon  General  of  the  Navy,  and  the  IHS  CIO. 

6.  Industry  Standards 

The  proliferation  of  committees  working  on  health  information  standards  is  an  indicator  of 
the  level  of  complexity  in  establishing  national  health  standards.  The  GCPR  will  likely  serve 
as  a  contributor  to  the  development  of  health  information  standards  and  be  of  value  to  federal 
and  industrywide  standards  panels. 

7.  Miscellaneous 

A)  Add  the  word  "Government"  so  the  title  reads  "Government  Computer-Based  Patient 
Record." 

B)  On  page  13,  paragraph  2,  line  9  an  inaccurate  acronym  was  used  for  the  Pharmacy  Data 
Transaction  System.  Please  replace  "(PTDS)"  with  "(PDTS)." 
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DEPARTMENT  OF  HEALTH  &  HUMAN  SERVICES 


MAR  2  3  2001 


Public  Health  Service 


Indian  Health  Service 
Rockville  MD  20857 


Mr.  Stephen  P.  Backhus 
Director,  Health  Care  -  Veterans  and 
Military  Health  Care  Issues 
United  States  General  Accounting  Office 
Washington,  D.C.  20548 

Dear  Mr .  Backhus : 

I  am  responding  to  your  March  15  letter,  regarding  the  General 
Accounting  Office  (GAO)  draft  report,  "Computer-Based  Patient 
Records:  Better  Planning  and  Oversight  By  VA,  DOD  and  IHS  Would 

Enhance  Health  Data. Sharing, *  (GAO-Ol-459).  The  Indian  Health 
Service  (IHS)  concurs  with  the  overall  findings  regarding  the 
Government  Computer-Based  Patient  Records  (GCPR)  project;  however, 
there  are  several  issues  that  I  would  like  to  discuss  in  order  to 
provide  the  appropriate  foundation  for  assessing  GCPR  and  its 
progress. 

1.  While  GCPR  is  a  very,  important  project,  it  was  not  meant  to 
carry  the  entire  weight  for  the  service  members'  health 
records  and  the  related  health  information  systems  within 
each  of  the  three  Agencies .  A  longitudinal  record  covering 
service  members  from  their  start  of  service  throughout  their 
care  with  the  Veterans  Administration  (VA)  consists  of  three 
primary  elements : 

The  Department  of  Defense's  (DOD)  core  health 
information  system  is  currently  Composite  Health  Care 
System  (CHCS)  I;  future  is  CHCS  II, 

The  GCPR  for  handling  the  transfer  and  mediation  of  data 
amongst  DOD,  VA,  and  IHS;  and. 

The  VA' s  core  health  information  system  is  currently 
Veterans  Information  Systems  Technology  Architect 
(VISTA) ,  future  is  next  generation  --  HealtheVet) . 

The  GCPR  also  has  a  critical  role  in  our  efforts  to  share 
information  with  the  private  sector. 

2 .  A  new  near-term  solution  has  been  developed  that  addresses 
the  concerns  raised  in  the  report.  This  near-term  solution 
uses  the  elements  of  the  GCPR  framework.  It  will  move  and 
bring  together  both  historical  and  current  health  information 
and  make  all  DOD  electronic  health  information  available  to 
VA  clinicians  in  sufficient  time  to  care  for  veterans.  The 
current  target  for  this  near-term  solution  is  September  30, 
2001. 
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Page 

2  -  Mr.  Stephen  P.  Backhus 

3  . 

With  respect  to  a  longer-term  strategy,  we  are  reassessing 
and  will  firm  up  that  longer-term  strategy  soon.  We 
anticipate  that  the  longer-term  strategy  will  be  as  follows: 

Phase  II  -  We  will  complete  the  middle-term  effort  to 
produce  the  GCPR  framework  that  allows  disparate  systems 
to  share  health  information.  Its  success  will  depend  to 
some  extent  on  our  ability  to  bring  in  additional 
partners . 

Phase  III  -  For  the  longer-term,  we  will  work  with  the 
private  sector  to  develop  similar,  standards-based 
health  information  systems  that  could  be  used  by  both 
the  public  and  private  sectors.  Resources  for  this 
effort  will  need  to  come  from  both  the  public  and 
private  sectors. 

4. 

The  development  of  GCPR  is  a  very  difficult  design  and  a 
development  effort,  that  has  not  been  done  before.  The  GCPR 
has  the  reduced  predictability  and  many  of  the 
characteristics  associated  with  research  and  development 
efforts.  To  judge  it  as  a  standard  information  system 
development  effort  is  to  underestimate  the  challenge  that  the 
three  Agencies  have  undertaken. 

5  . 

To  facilitate  the  very  open  process  for  developing  GCPR,  many 
ideas  and  documents  with  different  degrees  of  merit  are 
developed  by  staff  and  contractors  and  floated  for 
consideration.  Many  of  these  have  not  received  approval  from 
the  senior  decision-makers  and  should  not  be  treated  as  such. 

6. 

All  three  Agencies  are  facing  many  competing  demands  for 
their  scarce  resources.  We  are  firmly  committed  to  the  GCPR 
effort;  however,  we  need  to  use  our  scarce  resources 

carefully-. 

7. 

In  response  to  your  proposed  recommendation  regarding  the 
improvement  in  planning  and  oversight  by  the  Chief 

Information  Officers,  they  are  already  doing  that  as  [you] 
acknowledged  in  your  draft  report .  The  three  Agencies  are 
committed  to  maintaining  that  aggressive  planning  and 
oversight  through  the  successful  outcome  of  the  GCPR  effort. 

Finally,  while  we  have  focused  on  the  major  points,  there  are  two 
items  that  we  believe  should  be  corrected  in  the  final  report:  1) 

Page 

5,  first  paragraph  "...IHS  has  more  than  150  facilities  in  12 

regions..."  should  be  changed  to  "IHS  has  550  facilities  in  12 
regions..."  2)  Page  6,  footnote  -  Replace  "Area  Offices"  with 

Areas.  As  always,  we  look  forward  to  working  with  GAO  on  this 
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issue.  Collaboration  will  be  key  as  we  move  to  implement  the 
near-term  solution  for  sharing  information  with  the  DOD  and  the 
VA,  and  to  develop  the  longer-term  strategies  that  will  a)  enable 
information  sharing  amongst  disparate  health  information  systems 
across  the  nation  and  b)  result  in  more  similar,  standardized 
health  information  systems  for  both  the  public  and  private 
sectors.  Collaboration  amongst  the  three  Agencies  has  been  a  key 
element  in  the  progress  to  date  and  is  essential  to  the  future  of 
GCPR  and  other  information  system  efforts  of  common  interest. 

If  you  have  any  questions  regarding  this  letter,  you  may  contact 
Dr.  Richard  Church,  Director,  Division  of  Information  Resources, 
at  (301)  443-0750.  Thank  you  for  the  opportunity  to  comment  on 
this  important  report . 

Sincerely  yours, 


Michael  H . ,  M.D.,  M.P.H.,  M.S. 

Assistant  Surgeon  General 

Director 
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